8000 Client scopes evaluate function shows sub claim in access token even if "basic" client scope is not selected · Issue #37202 · keycloak/keycloak · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
Client scopes evaluate function shows sub claim in access token even if "basic" client scope is not selected #37202
Closed
@eicki

Description

@eicki

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

admin/ui

Describe the bug

With one of recent Keycloak updated the "sub" claim is no longer added by default to the access token. It has been reworked into a mapper and a client scope "basic". This is working as designed for real clients but if you go to Clients->Client scopes->Evaluate the sub claim is always present in the access token even if "basic" client scope is not set to Default.

Version

26.0.0

Regression

  • The issue is a regression

Expected behavior

I expect that the access token in admin ui evaluate function is identical to an access token retrieved by a real client, especially only containing the "sub" claim if added by a mapper or via the "basic" client scope.

Actual behavior

The "sub" claim is always displayed in the access token.

How to Reproduce?

Just create a simple client with default and click on evaluate in the client scopes, take a look at the access token. It contains the "sub" claim though not mapped.

Anything else?

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    0